A critical SQL injection vulnerability in VIAVIWEB Wallpaper Admin 1.0 allows unauthenticated attackers to bypass authentication and execute arbitrary code on the server.

The application is susceptible to SQL injection via the login page and improper file validation on the gallery upload endpoint. An unauthenticated attacker can manipulate database queries to bypass authentication or upload malicious PHP files to achieve remote code execution.

Successful exploitation allows an unauthenticated attacker to gain full administrative control over the application. This could lead to complete data compromise, unauthorized access to the underlying server, and total system compromise. Given the CVSS score of 8.2, this vulnerability represents a high risk to business operations and data confidentiality.

Immediate Action: Since there is no official patch available, administrators should restrict access to the administrative interface via network-level controls and disable the gallery image upload functionality until the vendor releases a security update.

Proactive Monitoring: Review web server access logs for anomalous requests containing SQL syntax or attempts to upload files with suspicious extensions, such as .php, to the application directories.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block common SQL injection patterns and restrict file upload types to only authorized image formats.

Public Exploit Available: Yes, a functional proof-of-concept and technical write-up are available on Exploit-DB (EDB-ID 51033).

Due to the presence of a public exploit and the severity of the impact, this vulnerability poses an immediate threat to any deployment of VIAVIWEB Wallpaper Admin 1.0. Organizations should treat this as a high-priority item, applying restrictive network access controls as a temporary measure until a vendor-supplied patch is available. Continued operation of the affected software without these mitigations is strongly discouraged.